TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1101-14Exploited in the wild
JetBrains TeamCity RCE (CVE-2026-63077): unauthenticated code execution on the CI server
An XStream deserialization flaw in the TeamCity agent polling protocol lets an unauthenticated attacker with HTTP access run code on the TeamCity server. JetBrains fixed it on July 27, CISA added it to KEV on August 5 after confirmed exploitation, and public exploits exist. Upgrade On-Premises to 2025.11.7 or 2026.1.3, then prove the build and rotate secrets.
SEVERITY
Critical
PEAK CVSS
9.8
AUTH REQUIRED
None
PUBLIC POC
Yes
PUBLISHED
Nov 1, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
Compromise a build server and you do not get one machine. You get the signing keys, the deploy tokens, the cloud credentials, and a trusted path straight into production, because that is a CI server's whole job.
CVE-2026-63077 hands an attacker that server. The channel build agents use to talk to the TeamCity server deserializes untrusted data with XStream, so an unauthenticated HTTP request bypasses authentication and runs code. No login, no user interaction, CVSS 9.8.
This is not a drill. JetBrains disclosed it on July 27, CISA added it to the Known Exploited Vulnerabilities catalog on August 5 with a three-day federal deadline, and multiple working proof-of-concepts and a packet capture are public. TeamCity Cloud is unaffected, which narrows the problem to self-hosted instances, but those are exactly the ones a busy platform team forgets to patch. Patching is step one; if an instance was exposed, the harder question is what it touched, which means rotating every secret it could reach.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a critical, unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises. The agent polling protocol deserializes untrusted data with XStream, so an attacker with HTTP access to the server can bypass authentication and run code. JetBrains fixed it in 2025.11.7 and 2026.1.3, CISA confirmed exploitation and added it to KEV, and public PoCs exist. Patch, confirm the serving build, and rotate any secrets the server could reach.
KEY JUDGMENTS
01
CISA added CVE-2026-63077 to its KEV catalog on Aug 5, 2026 after confirmed exploitation, and JetBrains reported both successful and attempted exploitation. Multiple public PoCs and a PCAP exist.Observed
02
Only TeamCity On-Premises is affected. TeamCity Cloud requires no action. Self-hosted instances, especially internet-facing ones, are the exposure.Assessed
03
A CI server concentrates source code, pipeline secrets, signing keys and deploy credentials, so impact extends well beyond the single host.Assessed
04
The flaw needs only HTTP access to the agent polling endpoint, typically port 8111, and no authentication, which makes mass scanning straightforward.Reproduced
CWE-502 deserialization of untrusted data (XStream / XML)
Vector
HTTP(S), pre-authentication, no user interaction
Affected
All On-Premises before 2025.11.7 and before 2026.1.3
Scoring
9.8 · CVSS v3.1
Not affected
TeamCity Cloud
Impact
Authentication bypass and code execution on the TeamCity server.
EXPOSURE: SELF-HOSTED, BELOW THE FIX
01TeamCity On-PremisesCloud is not affected.
02Below the fixed buildBefore 2025.11.7 or 2026.1.3.
03HTTP reachableAn attacker can reach the agent polling endpoint, often port 8111.
04Secrets on the serverCI variables, tokens and keys raise the stakes of a compromise.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedJetBrains confirmed exploitation.
CISA KEVListed Aug 5Three-day federal deadline.
PUBLIC POCAvailableMultiple PoCs and a PCAP.
PATCHAvailable2025.11.7, 2026.1.3, plus a plugin.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Jul 10A researcher reports the flaw to JetBrains privately under coordinated disclosure.
Jul 27JetBrains publishes the advisory, registers CVE-2026-63077, and ships 2025.11.7 and 2026.1.3 plus a security patch plugin.
Aug 5CISA adds it to KEV, confirming active exploitation, with an Aug 8 federal deadline under BOD 26-04.
Aug 7 to 9JetBrains confirms successful and attempted exploitation; public PoCs and a PCAP appear.
04 · AFFECTED PRODUCTS
Affected and fixed versions
The fix is in two release lines, with a security patch plugin for older installs that cannot upgrade immediately. The plugin addresses this CVE only.
PRODUCT
AFFECTED
FIXED IN
STATUS
TeamCity On-Premises 2026.1.x
before 2026.1.3
2026.1.3
Fixed
TeamCity On-Premises 2025.x
before 2025.11.7
2025.11.7
Fixed
TeamCity 2017.1 and later
if not upgradable
security patch plugin (this CVE only)
Mitigated
TeamCity Cloud
not affected
no action
Not affected
SECRET ROTATIONIf an unpatched instance was internet-facing, assume the server's secrets may have been read. Rotate CI/CD variables, access tokens and signing keys after patching.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing On-Premises TeamCityUpgrade to 2025.11.7 or 2026.1.3 now, or apply the security patch plugin if you cannot upgrade.
Confirmed or suspected exposureRotate CI/CD variables, tokens and signing keys the server could reach.
HighWithin 72 hours
All On-Premises instancesUpgrade, including internal-only servers. The flaw needs no authentication.
Build agents and runnersSegment them from production credentials and cloud environments.
AccessRestrict who can reach the server over HTTP while you patch.
HighBefore closing
Every instanceRecord the serving build, reachability, and whether secrets were rotated as evidence.
WORKAROUNDS
Apply the security patch plugin. For TeamCity 2017.1 and later that cannot upgrade immediately. It addresses this CVE only; still plan a full upgrade.Restrict HTTP access. Limit who can reach the TeamCity server, especially the agent polling endpoint, until patched.Segment agents and secrets. Keep build agents and stored credentials away from production and cloud control planes.Rotate after patching. Treat an exposed, unpatched instance as a possible secret leak and rotate accordingly.
06 · DETECTION AND HUNTING
Observables and hunting queries
Public PoCs and a PCAP exist, so network signatures are feasible. Hunt on the serving build, on agent-polling traffic, and on anomalous child processes of the TeamCity service.
TYPE
OBSERVABLE
SOURCE
Exposure
A serving build below 2025.11.7 or 2026.1.3
Version endpoint, admin area
Request
Unauthenticated agent polling requests carrying serialized XML payloads
TeamCity and reverse proxy logs
Behavior
The TeamCity server process spawning a shell or network tool
TeamCity build agents communicate with the central server over an agent polling protocol. CVE-2026-63077 is an insecure deserialization flaw (CWE-502) in that protocol: it deserializes untrusted XML with XStream without restricting the types it will instantiate. A crafted request to the polling endpoint lets an unauthenticated attacker drive object creation that ends in code execution, bypassing authentication entirely.
Because the endpoint is reachable over HTTP, typically on port 8111, and requires no credentials, exploitation needs only network access to the server. JetBrains fixed it by restricting deserialization in 2025.11.7 and 2026.1.3, and shipped a patch plugin for older installs. The real blast radius is the CI role itself: a TeamCity server holds source, pipeline secrets, signing keys and deploy credentials, so code execution there is a pivot into everything the pipeline can reach. That is why the response is patch plus secret rotation, not patch alone.
01 REACH
Attacker reaches the agent polling endpoint over HTTP
Control: Restrict HTTP access while patching
02 SEND
A crafted serialized payload is submitted
Control: Patch to 2025.11.7 or 2026.1.3
03 DESERIALIZE
XStream instantiates attacker-chosen types
Control: Security patch plugin for older installs
04 PIVOT
Code runs on the CI server, reaching secrets and deploys
GitLab CI/CD regex compiler RCE. Another unauthenticated path into the software delivery pipeline.
AssessedA build server is a production credential store with a web UI. Unauthenticated code execution on it is a supply-chain event, so patch and rotate, do not patch alone.
09 · VALIDATION
Confirm remediation
A changelog entry is not a verdict. Each instance should end with evidence: a fixed build serving, not reachable, or exposed and remediated with secrets rotated.
01
Read the serving version
From the running instance, not the deploy manifest.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-63077 being exploited?
Yes. CISA added it to KEV on August 5, 2026 after confirmed exploitation, JetBrains reported successful and attempted attacks, and public PoCs exist.
Which versions fix it?
TeamCity On-Premises 2025.11.7 and 2026.1.3. A security patch plugin is available for 2017.1 and later and addresses this CVE only.
Is TeamCity Cloud affected?
No. Only On-Premises is affected. Cloud customers need no action.
Do I need to rotate secrets?
If an unpatched instance was reachable, assume its stored secrets may have been read and rotate CI/CD variables, tokens and signing keys.
VALIDATE YOUR EXPOSURE
Prove your CI/CD exposure
Hayrok maps your self-hosted TeamCity instances, reads the serving build, checks reachability, and tests whether an exposed server could leak pipeline secrets. Every result lands in Evidence Fabric.